1. Field
This application generally relates to packet networks and more specifically to intelligently slicing packets obtained from packet networks.
2. Related Art
In a typical data network, data is transmitted as packets. A packet generally has a header and a data payload.
Typically, the contents of the packet header may include several fields containing information about the contents, size, source, destination, checksum, and type of packet. Occasionally, the end of a packet also contains a field. For example, the 802.3 Ethernet standard specifies that a packet checksum is located in the final four bytes of an Ethernet packet. The format, size, and content of a packet header depend largely on the protocol of the packet. The packet data payload contains the data message that is being transmitted. Alternatively, a second packet can be layered within the data payload of a first packet.
When network problems occur, such as dropped packets, excessive lag, or low throughput, information contained in packet headers can be used to aid the diagnosis of the problem. Often, a large number of packets are needed to diagnose a problem fully. Therefore, storage of packets is often useful to enable later analysis and inspection. Additionally, a network professional is typically required to analyze the packets. The network specialist will often be off site from the network. Again, this requires that the packets be stored and transmitted to the network professional for inspection and analysis.
Networks often span a very large physical area. When a problem occurs, localizing the problem to a specific area may be difficult. Therefore, transmitting packets from locations all over the network to a central location for storage and analysis is often desirable.
While a single packet is typically small, storing a very large number of packets can quickly burden a storage device. Additionally, retransmission of packets from locations all over the network to the storage location can significantly affect bandwidth of the network. The most relevant portions of a packet for problem diagnosis, the headers, are generally a small fraction of the overall packet size. Therefore, to conserve bandwidth and reduce storage requirements, packet slicing devices can remove irrelevant portions of the packet prior to retransmission and storage.
However, conventional packet slicing techniques are based on slicing at a fixed offset regardless of the protocol, size, or contents of a packet. Therefore, often relevant portions are lost or irrelevant portions are retained.